Access Control — Manas AI

Checking your access…

One moment.

Sessions are running on the fallback key. The platform normally generates its own signing key and keeps it in Blobs, but it could not be read on this request, so sessions are temporarily signed with a value derived from the site ID. This usually clears on its own — reload in a moment. If it persists, set MANAS_SESSION_SECRET in the Netlify environment and redeploy.

Break-glass password is active. MANAS_BOOTSTRAP_PASSWORD is set, which lets a super admin who has no password of their own sign in with it. Set a real password for yourself below, then remove the variable from the Netlify environment and redeploy.

Create a login

Grant an address a role and the caseloads it may open. Setting a password lets the person sign in with email and password; leaving it blank means they sign in through Netlify Identity and this record only decides what they reach.

Email address

Full name

Role

Title shown on the chip

Caseloads this account may open

A super admin holds every module regardless of what is ticked here — the role carries the reach. For every other role this list is the whole of it.

Designation The job title this person answers to. It is shown on their profile card on the Manas AI home screen, beside their name. Left blank, the card falls back to the role — "Physiotherapist", "Module Lead".

Centres (optional, comma separated)

Password Stored as a salted scrypt hash. It is never readable again — from this console or anywhere else — so a forgotten password is reset here, not looked up.

Note

Account is active

Who has access

Loading…

Data migration

Writes every record the platform holds into the shared export document and tells the clinic inbox when it has finished. Each press does as much as it can inside one function run and reports where it reached; press again to continue.

This transfers patient identifiers. Names, phone numbers, dates of birth, diagnoses and clinical notes travel in full into a Google Doc. Confirm the document's sharing is restricted to the people entitled to read them, and that a business associate agreement covers Google Workspace, before running it. Passwords, tokens and other credential material are always redacted and that is not configurable.

Checking…

Open the document

Change trail

Every grant, revocation, password reset and sign-in, most recent first. Written on the way through, so it records what happened rather than what the roster now says.

Loading…